Anomaly detection is used for determining when patterns in data do not match an expected pattern. For example, credit card companies may use anomaly detection to help detect fraudulent activity relating to a customer's credit card. An online service may create a rule to detect anomalous activity when network traffic exceeds a predetermined threshold. Detecting anomalous activity that is associated with an online service can be challenging and time consuming. For example, there is typically an extremely large amount of data relating to the operation of the online service that may need to be analyzed. Instead of processing this large amount of data, many online services detect anomalous activity by determining when a predefined event occurs on a single machine or a few machines of the online service. For example, the predefined event may occur in response to network traffic for the online service exceeding some predetermined level or when a large number of processes are started in a short time period.